Cookie Policy

This Cookie Policy explains how IX Labs uses cookies and similar technologies on the website at ingy.app. It is written to stand on its own: you do not need to read any other document to understand it.

Scope and definitions

1.1 The capacity in which we act. For the cookies and similar technologies this policy covers, we act as a controller: we decide why they are set and how the resulting data is used. Where a third party sets its own cookies through our site — Creem at checkout — that third party is an independent controller for its own cookies, as section 6 explains.

1.2 In this policy, "we", "us" and "our" mean IX Labs. "You" and "your" mean the visitor to our website.

1.3 We have not appointed a Data Protection Officer. We are not required to appoint one under UK data protection law. Any question about this policy or about how we handle your data should go to [email protected].

1.4 Our use of cookies is governed by the Privacy and Electronic Communications (EC Directive) Regulations 2003 as amended (PECR), including the amendments made by the Data (Use and Access) Act 2025 which took effect on 5 February 2026, and — where cookie data is personal data — by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Scope: this policy covers the website only

2.1 This policy applies only to ingy.app. The website consists of a home page, comparison articles under /vs/, this legal library under /legal/, a /subscribe checkout page and a /thanks confirmation page. This is the only place where we use cookies.

2.2 The Ingy Telegram bot uses no cookies at all. Section 9 explains this and what it means.

3. What cookies are

3.1 A cookie is a small text file that a website asks your browser to store on your device. When you come back, the browser sends the cookie back to the site, which lets the site recognise your session, remember a setting, or count a visit.

3.2 The law does not only cover cookies. It covers any technology that stores information on your device or gains access to information already stored on it — including local storage, session storage, pixels, tags, software development kits and device fingerprinting. In this policy, when we say "cookies" we mean all of these.

3.3 Cookies can be described by who sets them and how long they last:

First-party cookies are set by the website you are visiting — us.
Third-party cookies are set by another organisation whose code runs on the page.
Session cookies are deleted when you close your browser.
Persistent cookies stay on your device until they expire or you delete them.

4. The rules we follow

4.1 Under PECR, we may only store information on your device or access information on it with your consent, unless the cookie is:

strictly necessary for a service you have expressly requested; or
used solely to transmit a communication over an electronic communications network.

4.2 Where consent is required, it must meet the UK GDPR standard: freely given, specific, informed and unambiguous, given by a clear affirmative act. That means:

nothing non-essential fires before you choose;
no pre-ticked boxes and no sliders switched on by default;
rejecting is exactly as easy as accepting — one click, equal prominence;
you can change your mind at any time, as easily as you gave consent.

4.3 We go further than the law requires. The Data (Use and Access) Act 2025 amended PECR from 5 February 2026 so that certain low-risk first-party analytics cookies — measuring how visitors use a site, in order to improve it — may be used without consent, provided visitors are given clear information and a way to object.

4.4 We have chosen not to rely on that exemption. We ask for your consent before any analytics or measurement cookie is set on our website. By default our website analytics run in a cookie-free mode: nothing is written to your device and nothing is read from it, so the rule in 4.1 is not engaged at all unless you choose to accept.

5. The categories of cookies we use

5.1.1 These cookies are required for the website to function and for services you have expressly asked for. Without them, the site does not work properly. We use them for three things:

Session and security — maintaining your session, protecting forms against cross-site request forgery, load balancing, and mitigating abuse of the site.
Checkout functionality — making the /subscribe checkout work, including cookies set by our payment provider so that a transaction can be completed securely.
Storing your cookie consent choice — remembering what you decided, so that we do not ask you again on every page and so that we can prove what you chose. Storing your choice is itself strictly necessary; it is how we honour your decision.

5.1.2 These cookies do not require your consent and cannot be switched off through our cookie banner. You can still block them in your browser, but parts of the site — including checkout — will stop working. See Section 8.

5.2.1 These cookies help us understand how people find and use our website: which pages are visited, how visitors move through the site, and how many people reach the checkout. We use this to improve the site. They run on every page except /subscribe and /thanks, which we measure on our own servers instead, and /health, which is a monitoring endpoint rather than a page.

5.2.2 No analytics cookie is set unless you accept. By default our website measurement runs cookie-free: it keeps no identifier on your device, so each visit is counted on its own and cannot be linked to your earlier or later visits. If you decline, or if you ignore the banner and never choose, it stays that way and none of the cookies in Section 6.2 are set.

5.2.3 If you accept, PostHog stores a randomly generated identifier on your device (Section 6.2) so that page views from the same browser can be counted as one visit rather than several. That identifier is not a name, an email address or an account, and we do not link it to your Telegram account or to anything you send the bot.

5.2.4 You can withdraw your consent at any time — see Section 7.

5.3 Categories we do not use

5.3.1 We do not use advertising or targeting cookies on our website. We do not sell personal data and we do not share website cookie data with third parties for their own independent advertising purposes.

5.3.2 We do not use cookies to build advertising profiles about you.

6.1 Strictly necessary (always active)

Cookie name	Provider	Purpose	Duration
`ix_session`	ingy.app (first party)	Maintains your browsing session so pages load correctly	Session
`ix_csrf`	ingy.app (first party)	Security token that protects forms against cross-site request forgery	Session
`ingy_analytics_consent`	ingy.app (first party)	Stores your analytics choice — the single value `granted` or `denied` — so we do not ask again and can honour what you chose. Contains no identifier and nothing else about you	12 months
Checkout cookies set by Creem	Creem (Armitage Labs OÜ)	Enable the `/subscribe` checkout to run and complete a transaction securely, and support fraud prevention during checkout	Session to 12 months

6.2 Analytics and measurement (only set if you accept)

Cookie name	Provider	Purpose	Duration
`ph_<project key>_posthog`	PostHog	Holds a randomly generated visitor identifier so that page views from the same browser count as one visit, and records those page views and interactions so we can see how the site is used and improve it	12 months
`ph_opt_out`	PostHog	Records that you have opted out of website analytics, so we continue to respect that	12 months

6.2.1 These are set only after you accept. Until then — and permanently, if you decline — website analytics run cookie-free, as described in 5.2.2.

6.2.2 Where the banner is shown. We show the consent banner to visitors in the UK, the EU and the wider EEA (Norway, Iceland and Liechtenstein) — the countries whose law imposes the consent rule described in Section 4. Visitors elsewhere are not shown a banner, and the cookies above are set on their first visit. Wherever you are, you can refuse or remove these cookies in your browser (Section 8), and the rest of this policy applies to you in full.

6.3 Where this data goes

6.3.1 Cookies set by us are processed on our own infrastructure, hosted by Hetzner Online GmbH in Germany.

6.3.2 Website analytics data is processed by PostHog, hosted in the United States. The transfer safeguards in 6.3.4 apply.

6.3.3 Checkout cookies are set by Creem (Armitage Labs OÜ, Estonia), our Merchant of Record. Creem acts as a separate, independent controller for payment data and applies its own privacy terms to it. Creem processes data in the European Union.

6.3.4 Where personal data is transferred outside the UK, we rely on UK adequacy regulations where they apply, or on the UK International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, supported by a transfer risk assessment. You can request a copy of the relevant safeguards from [email protected].

7. How to accept, reject or change your choice

7.1 When you first visit ingy.app from the UK, the EU or the wider EEA, a banner appears before any non-essential cookie is set. It gives you two options, each a single click of equal prominence:

Accept — allows the analytics cookies in Section 6.2 as well as strictly necessary ones;
Decline — keeps website analytics cookie-free, leaving only strictly necessary cookies.

There is no separate preferences panel, because analytics is the only non-essential category there is to decide about.

7.2 Rejecting is exactly as easy as accepting. The two buttons are the same size, the same visual weight and side by side. There is no extra step, no dark pattern, and no hidden reject option.

7.3 Nothing is pre-selected. Neither button is pre-chosen or presented as the recommended answer, and no analytics cookie is written while the banner is still open.

7.4 Nothing non-essential fires before you choose. If you ignore the banner, we treat that as no consent: measurement stays cookie-free and no analytics cookie is set, however long you browse.

7.5 Changing or withdrawing your choice. You can withdraw your consent at any time by deleting our cookies for ingy.app in your browser — Section 8 explains how in each major browser. That removes the analytics identifier and the record of your choice, so measurement returns to the cookie-free default and the banner will ask you again on your next visit, where you can decline. You can also email [email protected] and we will confirm the withdrawal and erase the data associated with it.

7.6 What happens when you withdraw. Once those cookies are cleared, no new analytics cookie is set unless you accept again, and measurement goes back to keeping no identifier on your device. Data already collected while your consent was valid remains lawful, but you can ask us to erase it — see Section 11.

7.7 We ask again periodically. Your consent record expires 12 months after you make it (Section 6.1), after which we will ask you again. We will also ask again if we add a new cookie or a new purpose that your earlier choice did not cover.

8. Controlling cookies in your browser

8.1 Independently of our banner, you can control cookies in your browser. Most browsers let you see what is stored, delete cookies, block third-party cookies, or block all cookies.

8.2 The controls are usually found under:

Google Chrome — Settings → Privacy and security → Third-party cookies / Site data
Mozilla Firefox — Settings → Privacy & Security → Cookies and Site Data
Apple Safari — Settings/Preferences → Privacy → Manage Website Data
Microsoft Edge — Settings → Cookies and site permissions
Mobile browsers — in the browser app's own settings

8.3 A warning. If you block or delete strictly necessary cookies, parts of ingy.app will stop working — including the /subscribe checkout. If you delete our consent cookie, we lose the record of your choice and the banner will appear again.

8.4 Many browsers offer a "Do Not Track" or global privacy signal. There is no settled UK legal standard for these, and we do not currently represent that we act on them. Use the banner and the footer link instead — those are the controls we honour.

9. The Telegram bot uses no cookies — and what that means

9.1 This section matters, because it is the most common source of confusion.

9.2 The Ingy Telegram bot (@IngyAppBot) sets no cookies and uses no similar technologies. Cookies are a web browser technology. The bot does not run in a browser. It does not store information on your device and does not gain access to information stored on your device.

9.3 Therefore PECR's consent rule does not apply to the bot. The rule in Section 4.1 is triggered by storing or accessing information on a user's device. Nothing of the kind happens in the bot, so there is nothing for you to consent to and nothing for a cookie banner to gate.

9.4 Our bot-side analytics are server-side and are not covered by this policy or by the cookie banner. Specifically:

Product analytics. We measure how the bot is used — retention, churn, funnels and feature usage — using events sent from our own servers. These events deliberately contain no user content: no post text, no source text, no instruction text, no titles, no notes. URLs are reduced to hostname only. IP-based geolocation is disabled. This runs under our legitimate interests, not consent.
LLM tracing. We trace our AI pipeline for debugging, quality and cost. Unlike product analytics, these traces do contain the actual prompt and output content, keyed to a user ID. They are processed by Langfuse, hosted in the EU cloud. This also runs under our legitimate interests, not consent.

9.5 To be unambiguous: accepting or rejecting cookies on ingy.app has no effect on the bot, because there are no cookies in the bot. The cookie banner governs the website only.

9.6 You still have rights over bot-side processing. Where we rely on legitimate interests, you have the right to object under Article 21 UK GDPR. Email [email protected].

10. Legal bases

10.1 Strictly necessary cookies. Exempt from the PECR consent requirement. Where the data is personal data, we process it on the basis of our legitimate interests in operating a secure, functional website, and on contract where the cookie is needed to deliver a service you asked for, such as checkout.

10.2 Analytics and measurement cookies. Consent, under PECR and under UK GDPR Article 6(1)(a). You may withdraw it at any time under Section 7.5, without affecting the lawfulness of processing carried out before withdrawal.

11. Your rights

11.1 Where cookie data is personal data, you have the rights under UK GDPR to: access it; have it rectified; have it erased; have processing restricted; portability; object to processing based on legitimate interests; and withdraw consent at any time.

11.2 To exercise any of these, email [email protected]. We will respond within one month, and will tell you if we need to extend that for a complex request.

11.3 Complaints. If you are unhappy with how we handle cookies or your data, please tell us first at [email protected]. You may also complain to the UK supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom
Website: ico.org.uk
Helpline: 0303 123 1113

11.4 Complaining to the ICO does not affect any other legal remedy available to you.

12. Children

12.1 Our service is for adults. It is 18+. The website is not directed at children and we do not knowingly set cookies for, or collect data from, anyone under 18. If you believe we have, contact [email protected].

13. Changes to this policy

13.1 We may update this policy when we change the cookies we use, add a provider, or when the law changes.

13.2 Each version carries a version number and effective date at the top. The current version is 1.1, effective 30 August 2026.

13.3 If we introduce a new non-essential cookie or a new purpose that your existing choice does not cover, we will ask for your consent again before setting it.

14. Contact and company details

14.1 Questions about cookies, this policy or your data:

Email: [email protected]

14.2 Legal matters and formal notices: